<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width">
<meta name="theme-color" content="#222"><meta name="generator" content="Hexo 7.3.0">

  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32.ico">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16.ico">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">



<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css" integrity="sha256-wiz7ZSCn/btzhjKDQBms9Hx4sSeUYsDrTLg7roPstac=" crossorigin="anonymous">
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.1.1/animate.min.css" integrity="sha256-PR7ttpcvz8qrF57fur/yAx1qXMFJeJFiA6pSzWi0OIE=" crossorigin="anonymous">
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/fancyapps-ui/5.0.28/fancybox/fancybox.css" integrity="sha256-6cQIC71/iBIYXFK+0RHAvwmjwWzkWd+r7v/BX3/vZDc=" crossorigin="anonymous">
  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/pace/1.2.4/themes/green/pace-theme-minimal.css">
  <script src="https://cdnjs.cloudflare.com/ajax/libs/pace/1.2.4/pace.min.js" integrity="sha256-gqd7YTjg/BtfqWSwsJOvndl0Bxc8gFImLEkXQT8+qj0=" crossorigin="anonymous"></script>

<script class="next-config" data-name="main" type="application/json">{"hostname":"sumumm.github.io","root":"/","images":"/images","scheme":"Gemini","darkmode":false,"version":"8.19.2","exturl":false,"sidebar":{"position":"left","display":"post","padding":18,"offset":12},"copycode":{"enable":true,"style":"mac"},"fold":{"enable":true,"height":300},"bookmark":{"enable":false,"color":"#222","save":"auto"},"mediumzoom":false,"lazyload":true,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"stickytabs":false,"motion":{"enable":true,"async":true,"transition":{"menu_item":"fadeInDown","post_block":"fadeIn","post_header":"fadeInDown","post_body":"fadeInDown","coll_header":"fadeInLeft","sidebar":"fadeInUp"}},"i18n":{"placeholder":"搜索...","empty":"没有找到任何搜索结果：${query}","hits_time":"找到 ${hits} 个搜索结果（用时 ${time} 毫秒）","hits":"找到 ${hits} 个搜索结果"},"path":"/search.xml","localsearch":{"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false}}</script><script src="/js/config.js"></script>

    <meta name="description" content="本文主要是网络基础——wireshark工具介绍和使用的相关笔记，若笔记中有错误或者不合适的地方，欢迎批评指正😃。">
<meta property="og:type" content="article">
<meta property="og:title" content="LV06-01-网络工具-02-wireshark">
<meta property="og:url" content="https://sumumm.github.io/post/99bb7a64.html">
<meta property="og:site_name" content="苏木">
<meta property="og:description" content="本文主要是网络基础——wireshark工具介绍和使用的相关笔记，若笔记中有错误或者不合适的地方，欢迎批评指正😃。">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618110846035.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111433972.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111453975.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111506066.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111522630.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623061241634.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623061406002.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623063051820.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623063242825.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623063559863.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623064059307.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623065749049.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623070731215.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623071226766.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623071228755.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623082957437.png">
<meta property="og:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623085909290.png">
<meta property="article:published_time" content="2024-10-27T03:49:07.000Z">
<meta property="article:modified_time" content="2025-06-13T16:25:56.996Z">
<meta property="article:author" content="苏木">
<meta property="article:tag" content="LV06-网络编程">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618110846035.png">


<link rel="canonical" href="https://sumumm.github.io/post/99bb7a64.html">



<script class="next-config" data-name="page" type="application/json">{"sidebar":"","isHome":false,"isPost":true,"lang":"zh-CN","comments":"","permalink":"https://sumumm.github.io/post/99bb7a64.html","path":"post/99bb7a64.html","title":"LV06-01-网络工具-02-wireshark"}</script>

<script class="next-config" data-name="calendar" type="application/json">""</script>
<title>LV06-01-网络工具-02-wireshark | 苏木</title>
  








    <script src="/js/browser_tools_disable.js"></script>

  <noscript>
    <link rel="stylesheet" href="/css/noscript.css">
  </noscript>
<!-- hexo injector head_end start --><link rel="stylesheet" href="https://unpkg.com/hexo-next-tags-plus@latest/lib/tag_plus.css" media="defer" onload="this.media='all'"><!-- hexo injector head_end end --></head>

<body itemscope itemtype="http://schema.org/WebPage" class="use-motion">
  <div class="headband"></div>

  <main class="main">
    <div class="column">
      <header class="header" itemscope itemtype="http://schema.org/WPHeader"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏" role="button">
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
        <span class="toggle-line"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <i class="logo-line"></i>
      <p class="site-title">苏木</p>
      <i class="logo-line"></i>
    </a>
      <p class="site-subtitle" itemprop="description">我的学习之路</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger" aria-label="搜索" role="button">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>



<nav class="site-nav">
  <ul class="main-menu menu"><li class="menu-item menu-item-home"><a href="/" rel="section"><i class="fa fa-home fa-fw"></i>苏木的家</a></li><li class="menu-item menu-item-categories"><a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类页<span class="badge">42</span></a></li><li class="menu-item menu-item-archives"><a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档页<span class="badge">673</span></a></li><li class="menu-item menu-item-flink"><a href="/flink/" rel="section"><i class="fa fa-link fa-fw"></i>友人帐</a></li><li class="menu-item menu-item-about"><a href="/about/" rel="section"><i class="fa fa-user fa-fw"></i>关于我</a></li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup"><div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off" maxlength="80"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close" role="button">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div class="search-result-container no-result">
  <div class="search-result-icon">
    <i class="fa fa-spinner fa-pulse fa-5x"></i>
  </div>
</div>

    </div>
  </div>

</header>
        
  
  <aside class="sidebar">

    <div class="sidebar-inner sidebar-nav-active sidebar-toc-active">
      <ul class="sidebar-nav">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <div class="sidebar-panel-container">
        <!--noindex-->
        <div class="post-toc-wrap sidebar-panel">
            <div class="post-toc animated"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#%E4%B8%80%E3%80%81wireshark%E7%AE%80%E4%BB%8B"><span class="nav-text">一、wireshark简介</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#%E4%BA%8C%E3%80%81wireshark%E5%AE%89%E8%A3%85"><span class="nav-text">二、wireshark安装</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#1-%E5%9C%A8Ubuntu%E4%B8%AD%E5%AE%89%E8%A3%85"><span class="nav-text">1. 在Ubuntu中安装</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-%E5%9C%A8Windows%E4%B8%8B%E5%AE%89%E8%A3%85"><span class="nav-text">2. 在Windows下安装</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#%E4%B8%89%E3%80%81%E5%9F%BA%E6%9C%AC%E4%BD%BF%E7%94%A8"><span class="nav-text">三、基本使用</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#1-%E6%8A%93%E5%8C%85%E5%AE%9E%E4%BE%8B"><span class="nav-text">1. 抓包实例</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#1-1-%E9%80%89%E6%8B%A9%E7%BD%91%E5%8D%A1"><span class="nav-text">1.1 选择网卡</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#1-2-ping"><span class="nav-text">1.2 ping</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#1-3-%E5%81%9C%E6%AD%A2%E6%8A%93%E5%8C%85"><span class="nav-text">1.3 停止抓包</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#1-4-%E4%BF%9D%E5%AD%98%E6%95%B0%E6%8D%AE"><span class="nav-text">1.4 保存数据</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-%E7%95%8C%E9%9D%A2%E7%AE%80%E4%BB%8B"><span class="nav-text">2. 界面简介</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#3-%E8%BF%87%E6%BB%A4%E5%99%A8"><span class="nav-text">3. 过滤器</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#3-1-%E6%8D%95%E8%8E%B7%E8%BF%87%E6%BB%A4%E5%99%A8"><span class="nav-text">3.1 捕获过滤器</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#3-1-1-%E8%AE%BE%E7%BD%AE%E6%96%B9%E5%BC%8F"><span class="nav-text">3.1.1 设置方式</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#3-1-2-%E8%A1%A8%E8%BE%BE%E5%BC%8F%E8%AF%AD%E6%B3%95"><span class="nav-text">3.1.2 表达式语法</span></a></li></ol></li><li class="nav-item nav-level-3"><a class="nav-link" href="#3-3-%E6%98%BE%E7%A4%BA%E8%BF%87%E6%BB%A4%E5%99%A8"><span class="nav-text">3.3 显示过滤器</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#3-3-1-%E8%AE%BE%E7%BD%AE%E6%96%B9%E5%BC%8F"><span class="nav-text">3.3.1 设置方式</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#3-3-2-%E8%A1%A8%E8%BE%BE%E5%BC%8F%E8%AF%AD%E6%B3%95"><span class="nav-text">3.3.2 表达式语法</span></a></li></ol></li></ol></li></ol></li></ol></div>
        </div>
        <!--/noindex-->

        <div class="site-overview-wrap sidebar-panel">
          <div class="site-author animated" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="苏木"
      src="/images/avatar.jpg">
  <p class="site-author-name" itemprop="name">苏木</p>
  <div class="site-description" itemprop="description">莫道桑榆晚，为霞尚满天</div>
</div>
<div class="site-state-wrap animated">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
        <a href="/archives/">
          <span class="site-state-item-count">673</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
          <a href="/categories/">
        <span class="site-state-item-count">42</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
        <span class="site-state-item-count">43</span>
        <span class="site-state-item-name">标签</span>
      </div>
  </nav>
</div>
  <div class="links-of-author animated">
      <span class="links-of-author-item">
        <a href="https://github.com/sumumm" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;sumumm" rel="noopener me" target="_blank"><i class="fab fa-github fa-fw"></i>GitHub</a>
      </span>
  </div>

        </div>
      </div>
    </div>

    
  </aside>


    </div>

    <div class="main-inner post posts-expand">


  


<div class="post-block">
  
  

  <article itemscope itemtype="http://schema.org/Article" class="post-content" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://sumumm.github.io/post/99bb7a64.html">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/avatar.jpg">
      <meta itemprop="name" content="苏木">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="苏木">
      <meta itemprop="description" content="莫道桑榆晚，为霞尚满天">
    </span>

    <span hidden itemprop="post" itemscope itemtype="http://schema.org/CreativeWork">
      <meta itemprop="name" content="LV06-01-网络工具-02-wireshark | 苏木">
      <meta itemprop="description" content="">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          LV06-01-网络工具-02-wireshark
        </h1>

        <div class="post-meta-container">
          <div class="post-meta">
    <span class="post-meta-item">
      <span class="post-meta-item-icon">
        <i class="far fa-calendar"></i>
      </span>
      <span class="post-meta-item-text">发表于</span>

      <time title="创建时间：2024-10-27 11:49:07" itemprop="dateCreated datePublished" datetime="2024-10-27T11:49:07+08:00">2024-10-27</time>
    </span>
    <span class="post-meta-item">
      <span class="post-meta-item-icon">
        <i class="far fa-folder"></i>
      </span>
      <span class="post-meta-item-text">分类于</span>
        <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
          <a href="/categories/%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/" itemprop="url" rel="index"><span itemprop="name">嵌入式开发</span></a>
        </span>
          ，
        <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
          <a href="/categories/%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/" itemprop="url" rel="index"><span itemprop="name">01HQ课程体系</span></a>
        </span>
          ，
        <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
          <a href="/categories/%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/" itemprop="url" rel="index"><span itemprop="name">LV06-网络编程</span></a>
        </span>
    </span>

  
    <span class="post-meta-break"></span>
    <span class="post-meta-item" title="本文字数">
      <span class="post-meta-item-icon">
        <i class="far fa-file-word"></i>
      </span>
      <span class="post-meta-item-text">本文字数：</span>
      <span>4.1k</span>
    </span>
    <span class="post-meta-item" title="阅读时长">
      <span class="post-meta-item-icon">
        <i class="far fa-clock"></i>
      </span>
      <span class="post-meta-item-text">阅读时长 &asymp;</span>
      <span>15 分钟</span>
    </span>
</div>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody"><p>本文主要是网络基础——wireshark工具介绍和使用的相关笔记，若笔记中有错误或者不合适的地方，欢迎批评指正😃。</p>
<span id="more"></span>

<!-- Photo: https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/ -->

<details class="folding-tag" blue><summary> 点击查看使用工具及版本 </summary>
              <div class='content'>
              <table>    <tr>        <td align="center" width=150px>Windows</td>        <td align="left">windows11</td>    </tr>    <tr>        <td align="center">Ubuntu</td>        <td align="left">Ubuntu16.04的64位版本</td>      </tr>    <tr>        <td align="center">VMware® Workstation 16 Pro</td>        <td align="left">16.2.3 build-19376536</td>      </tr>    <tr>        <td align="center">SecureCRT</td>        <td align="left">Version 8.7.2 (x64 build 2214)   -   正式版-2020年5月14日</td>      </tr>    <tr>        <td align="center">开发板</td>        <td align="left">正点原子 i.MX6ULL Linux阿尔法开发板</td>      </tr>    <tr>        <td align="center">uboot</td>        <td align="left">NXP官方提供的uboot，NXP提供的版本为uboot-imx-rel_imx_4.1.15_2.1.0_ga(使用的uboot版本为U-Boot 2016.03)</td>      </tr>    <tr>        <td align="center">linux内核</td>        <td align="left">linux-4.15(NXP官方提供)</td>      </tr>    <tr>        <td align="center">STM32开发板</td>        <td align="left">正点原子战舰V3(STM32F103ZET6)</td>      </tr></table>
              </div>
            </details>

<details class="folding-tag" blue><summary> 点击查看本文参考资料 </summary>
              <div class='content'>
              <table>    <tr><td align="center">参考方向  </td><td align="center">参考原文</td></tr>    <tr><td align="left">---</td><td align="left"><a href="" target="_blank">--- <i class="fa fa-external-link-alt"></i> </a></td></tr></table>
              </div>
            </details>

<details class="folding-tag" blue><summary> 点击查看相关文件下载 </summary>
              <div class='content'>
              <table>    <tr>        <td align="center">---</td>        <td align="left">--- <a href="" target="_blank">  <i class="fa fa-external-link-alt"></i></a></td>      </tr></table>
              </div>
            </details>

<h1 id="一、wireshark简介"><a href="#一、wireshark简介" class="headerlink" title="一、wireshark简介"></a><font size=3>一、<code>wireshark</code>简介</font></h1><p><code>WireShark</code>是非常流行的网络封包分析工具，可以截取各种网络数据包，并显示数据包详细信息。常用于开发测试过程中各种问题定位。<code>Wireshark</code> 于 <code>1998</code> 年首次发布，最初被称为 <code>Ethereal</code> 。<code>2006</code> 年，由于商标问题，开发商不得不将其名称改为 <code>Wireshark</code> 。另外该软件可以运行在 <code>Windows</code> 和 <code>Linux</code> 操作系统上。</p>
<h1 id="二、wireshark安装"><a href="#二、wireshark安装" class="headerlink" title="二、wireshark安装"></a><font size=3>二、<code>wireshark</code>安装</font></h1><h2 id="1-在Ubuntu中安装"><a href="#1-在Ubuntu中安装" class="headerlink" title="1. 在Ubuntu中安装"></a><font size=3>1. 在<code>Ubuntu</code>中安装</font></h2><p>为了获取最新版本的<code>wireshark</code>，我们通过<code>PPA</code>来安装这个软件：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">sudo add-apt-repository ppa:wireshark-dev/stable</span><br><span class="line">sudo apt update</span><br><span class="line">sudo apt install wireshark</span><br></pre></td></tr></table></figure>

<p>主要是上边的三条命令，按照提示进行安装即可。通过这种方式进行安装，即使安装了旧版本的 <code>Wireshark</code> ，它也将更新为新版本。</p>
<p>安装时（安装过程可能比较慢长，可以做点其他的事），系统将会询问我们是否允许非超级用户捕获数据包。选择<code>Yes</code>允许的话，即便不是<code>root</code>用户，也可以使用软件捕获数据包，选择<code>No</code>将会限制非超级用户捕获数据包，选择完毕后便会完成安装。</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618110846035.png" alt="image-20220618110846035" style="zoom: 50%;" />

<p>安装完成后，打开软件，软件界面如下图所示：</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111433972.png" alt="image-20220618111433972" style="zoom: 50%;" />



<p>操作完成后，最好重启一下，这样就可以识别到当前系统的网卡啦，我安装好的时候是没显示<code>ens</code>开头的信息的，重启一下<code>Ubuntu</code>系统就好啦。</p>
<p>如果说在软件包设置那个界面选了 否(<code>No</code>)  ，这个时候当我们终端直接运行<code>wiresirk</code>是没有问题的，可以正常打开界面，但是当我们开始抓包的时候就会弹出以下提醒，要是想在非<code>root</code>用户下也可以捕获数据包，要怎么办呢？</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111453975.png" alt="image-20220618111453975" style="zoom:50%;" />

<p>我们在终端输入以下命令，便会重新弹出软件包设置界面。然后选择是即可。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo dpkg-reconfigure wireshark-common</span><br></pre></td></tr></table></figure>

<p>软件设置完毕后，由于我们需要允许非超级用户捕获数据包，因此必须将该用户添加到 <code>wireshark</code> 组。使用 <code>usermod</code>命令将自己添加到 <code>wireshark</code> 组。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo usermod -aG wireshark $(whoami)</span><br></pre></td></tr></table></figure>

<p>如此便可以在非<code>root</code>下，正常捕获数据包啦。</p>
<h2 id="2-在Windows下安装"><a href="#2-在Windows下安装" class="headerlink" title="2. 在Windows下安装"></a><font size=3>2. 在<code>Windows</code>下安装</font></h2><p>其实多数情况，我们可能会在虚拟机中的<code>wireshark</code>中捕获数据包，然后放到<code>Windows</code>下来分析，可能会更方便一些。我们可以在这里下载<code>wireshark</code>软件的安装包：<a target="_blank" rel="noopener" href="https://www.wireshark.org/#download">Wireshark · Go Deep-Download. <i class="fa fa-external-link-alt"></i> </a></p>
<figure class="highlight html"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">https://www.wireshark.org/#download</span><br></pre></td></tr></table></figure>

<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111506066.png" alt="image-20220618111506066" style="zoom: 25%;" />

<p>我们在这里下载<code>Windows Installer (64-bit)</code>，下载完成后，双击<code>.exe</code>可执行文件即可开始安装，这个没什么好说的，就是一路默认，一路<code>next</code>就完事了。安装完成后，双击运行，界面如下所指示：</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220618111522630.png" alt="image-20220618111522630" style="zoom:33%;" />

<h1 id="三、基本使用"><a href="#三、基本使用" class="headerlink" title="三、基本使用"></a><font size=3>三、基本使用</font></h1><h2 id="1-抓包实例"><a href="#1-抓包实例" class="headerlink" title="1. 抓包实例"></a><font size=3>1. 抓包实例</font></h2><p>首先还是需要来看一下怎么抓包，这里我们抓取一下<code>ping</code>命令操作过程中的数据包，这里我们直接在<code>Windows</code>下的<code>wireshark</code>软件中进行。</p>
<h3 id="1-1-选择网卡"><a href="#1-1-选择网卡" class="headerlink" title="1.1 选择网卡"></a><font size=3>1.1 选择网卡</font></h3><p>当我们进入<code>wireshark</code>的时候，会看到接口选择界面，我们选择显示所有接口，由于我的电脑连接的是<code>Wifi</code>所以我这里选择<code>WLAN</code>。</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623061241634.png" alt="image-20220623061241634" style="zoom: 33%;" />

<p>双击之后，便会进入抓包的界面（或者就是【右键】&rarr;【<code>start capture</code>】），如下图所示：</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623061406002.png" alt="image-20220623061406002" style="zoom:33%;" />

<p>双击之后直接就开始抓包了，这个时候我还开着网页以及一些联网的应用，所以出来直接就有很多数据了，在<code>Ubuntu</code>中的时候好像就没有这么多的。</p>
<h3 id="1-2-ping"><a href="#1-2-ping" class="headerlink" title="1.2 ping"></a><font size=3>1.2 <code>ping</code></font></h3><p>保持开启抓包的状态，然后我们打开<code>Windows</code>中的命令提示符，输入以下命令：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">ping www.baidu.com</span><br></pre></td></tr></table></figure>

<p>然后就会测试我们能否与该网站连通，界面如下所示：</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623063051820.png" alt="image-20220623063051820" style="zoom: 50%;" />

<h3 id="1-3-停止抓包"><a href="#1-3-停止抓包" class="headerlink" title="1.3 停止抓包"></a><font size=3>1.3 停止抓包</font></h3><p>如下图所示，点击这个红色的方框就可以停止抓包了。</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623063242825.png" alt="image-20220623063242825" style="zoom: 33%;" />

<h3 id="1-4-保存数据"><a href="#1-4-保存数据" class="headerlink" title="1.4 保存数据"></a><font size=3>1.4 保存数据</font></h3><p>我们通过该软件抓到的数据包是可以进行保存，并在其他计算机中使用该软件打开分析的。</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623063559863.png" alt="image-20220623063559863" style="zoom:33%;" />

<p>然后我们这一次抓的包就会保存下来，保存的数据包文件后缀名为<code>.pcapn</code>。</p>
<h2 id="2-界面简介"><a href="#2-界面简介" class="headerlink" title="2. 界面简介"></a><font size=3>2. 界面简介</font></h2><p>界面如下图所示：</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623064059307.png" alt="image-20220623064059307" style="zoom: 33%;" />

<ul>
<li>（1）菜单栏：用于调试，配置，保存等功能，其实所有的功能都可以在菜单栏进行操作；</li>
<li>（2）工具栏：就是一些常用功能的快捷方式，如保存捕获数据、停止捕获和开始捕获等；</li>
<li>（3）过滤栏：在这里指定过滤的规则，过滤我们需要的数据包；</li>
<li>（4）数据包列表：这里是我们捕获的所有数据包，每一行就是一个数据包；</li>
<li>（5）数据包详情：每个数据包的详细数据；</li>
</ul>
<details class="folding-tag" blue><summary> 点击查看各部分说明 </summary>
              <div class='content'>
              <p>有的数据包详情中可能不仅仅有上图的四条：</p><img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623065749049.png" alt="image-20220623065749049" style="zoom:33%;" /><ul><li><code>Frame</code>: 物理层的数据帧概况，对应的是物理层；</li><li><code>Ethernet II</code>: 数据链路层以太网帧头部信息，对应的是数据链路层；</li><li><code>Internet Protocol Version 4</code>: 互联网层<code>IP</code>包的头部信息，对应的是网络层</li><li><code>Transmission Control Protocol</code>: 传输层的数据段头部信息，此处是<code>TCP</code>，对应的是传输层</li><li><code>Hypertext Transfer Protocol</code>: 应用层的信息，这一种就是<code>HTTP</code>协议，对应的是应用层</li></ul><p>与<code>OSI</code>七层模型的对应关系如下图所示：</p><img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623070731215.png" alt="image-20220623070731215" style="zoom:33%;" />
              </div>
            </details>

<ul>
<li>（6）数据包字节：数据包对应的字节流，二进制的形式显示。</li>
</ul>
<h2 id="3-过滤器"><a href="#3-过滤器" class="headerlink" title="3. 过滤器"></a><font size=3>3. 过滤器</font></h2><p>我们在抓取数据包的时候会抓取大量不相关的数据包，如何过滤出我们需要的呢？<code>wireshark</code>给我们提供了提供了两个过滤器：捕获过滤器 和 显示过滤器。两个过滤器的过滤思路不同。</p>
<ul>
<li>捕获过滤器：重点在动作，需要的数据包才抓，不需要的就不抓。</li>
<li>显示过滤器：重点在数据包的显示，所有的数据包已经抓了，只是不显示不需要的。</li>
</ul>
<h3 id="3-1-捕获过滤器"><a href="#3-1-捕获过滤器" class="headerlink" title="3.1 捕获过滤器"></a><font size=3>3.1 捕获过滤器</font></h3><h4 id="3-1-1-设置方式"><a href="#3-1-1-设置方式" class="headerlink" title="3.1.1 设置方式"></a><font size=3>3.1.1 设置方式</font></h4><p>我们只想抓一些自己需要的包，那么我们就需要在启动抓包之前或者停止抓包后使用捕获过滤器，我们在抓包开始之前，打开捕获过滤器界面：【菜单栏】&rarr;【捕获】&rarr;【选项】，然后便会打开以面板：</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623071226766.png" alt="image-20220623071226766" style="zoom:33%;" />

<p>【注意】这里会有自动的语法检测，当输入框变为绿色的时候说明语法正确，可以开始捕获，若为粉红色，则不能开始捕获，开始按钮也为灰色，无法选中。</p>
<p>有一些通用的捕获过滤器表达式每一次都全部写一遍不免有些麻烦，我们可以在捕获过滤器选项中保存一些通用的过滤器，然后在设置捕获过滤器的时候直接选择即可：【菜单栏】&rarr;【捕获】&rarr;【捕获过滤器】</p>
<img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623071228755.png" alt="image-20220623071228755" style="zoom:33%;" />

<h4 id="3-1-2-表达式语法"><a href="#3-1-2-表达式语法" class="headerlink" title="3.1.2 表达式语法"></a><font size=3>3.1.2 表达式语法</font></h4><p>捕获过滤器表达式的语法格式被称为<code>BPF</code>，（全称 <code>Berkeley Packet Filter</code>），中文叫伯克利封包过滤器。语法格式为：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;Protocol&gt; &lt;Direction&gt; &lt;Type&gt; &lt;Value&gt; &lt;逻辑运算符&gt; &lt;其他表达式&gt;</span><br></pre></td></tr></table></figure>

<p>各部分含义如下：</p>
<table>
    <tr><td align="center" width=150px>协议 Protocol</td><td align="left">各种网络协议，比如：tcp、udp、http</td></tr>
    <tr><td align="center" width=150px>方向 Direction</td><td align="left">源地址（src）、目标地址（dst）</td></tr>
    <tr><td align="center" width=150px>类型 Type</td><td align="left">主机（host）、网段（net）、端口（port）</td></tr>
    <tr><td align="center" width=150px>值 value</td><td align="left">主机（host）、网段（net）、端口（port）等的值</td></tr>
    <tr><td align="center" width=150px>逻辑运算符</td><td align="left">与（ && ）、或（ || ）、非（ ！）</td></tr>
    <tr><td align="center" width=150px>其他表达式</td><td align="left">需要同时应用的其他过滤器表达式</td></tr>
</table>


<p>【注意】这些个元素可以自由组合。</p>
<details class="folding-tag" blue><summary> 点击查看实例 </summary>
              <div class='content'>
              <ul><li>抓取<code>TCP</code>数据包</li></ul><p>我们新增一个捕获过滤器，表达式的值设为：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">TCP</span><br></pre></td></tr></table></figure><img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623082957437.png" alt="image-20220623082957437" style="zoom: 33%;" /><p>然后我们就可以开始只捕捉<code>TCP</code>的数据包了。</p><ul><li>抓取固定源的数据包</li></ul><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">src host 192.168.1.10</span><br></pre></td></tr></table></figure><p>这个就不再放图了，跟上边一样的设置方法。</p>
              </div>
            </details>

<h3 id="3-3-显示过滤器"><a href="#3-3-显示过滤器" class="headerlink" title="3.3 显示过滤器"></a><font size=3>3.3 显示过滤器</font></h3><h4 id="3-3-1-设置方式"><a href="#3-3-1-设置方式" class="headerlink" title="3.3.1 设置方式"></a><font size=3>3.3.1 设置方式</font></h4><p>下边我们来看一下另一种显示过滤器，这种过滤器会抓取全部的包，然后通过显示过滤器显示我们需要的包。显示过滤器的使用就在工具栏下边，即便是正在捕获数据包，也依然可以使用显示过滤器：</p>
<p><img data-src="https://fanhua-picture.oss-cn-hangzhou.aliyuncs.com/01%E5%B5%8C%E5%85%A5%E5%BC%8F%E5%BC%80%E5%8F%91/01HQ%E8%AF%BE%E7%A8%8B%E4%BD%93%E7%B3%BB/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/LV06-01-%E7%BD%91%E7%BB%9C%E5%B7%A5%E5%85%B7-02-wireshark/img/image-20220623085909290.png" alt="image-20220623085909290"></p>
<p>【注意】这里也会有自动的语法检测，当输入框变为绿色的时候说明语法正确，若为粉红色，说明语法有误，需要修改。</p>
<h4 id="3-3-2-表达式语法"><a href="#3-3-2-表达式语法" class="headerlink" title="3.3.2 表达式语法"></a><font size=3>3.3.2 表达式语法</font></h4><p>显示过滤器的语法如下：</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;协议&gt;.&lt;字段&gt; &lt;比较运算符&gt; &lt;值&gt; &lt;逻辑运算符&gt; &lt;其他表达式&gt;</span><br></pre></td></tr></table></figure>

<p>各部分说明如下：</p>
<table>
    <tr><td align="left" width=150px>协议</td><td align="left">tcp、udp、http等</td></tr>
    <tr><td align="left" width=150px>字段</td><td align="left">源IP端口(srcport)、目标IP端口(dstport)等</td></tr>
    <tr><td align="left" width=150px>比较运算符 </td><td align="left">&gt;、&lt;、==、&gt;=、&lt;=、!=</td></tr>
    <tr><td align="left" width=150px>逻辑运算符 </td><td align="left">and、or、not、xor(有且仅有一个条件被满足)</td></tr>
</table>


<p>例如，</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">tcp.srcport == 443     # 只抓取源IP端口为443的tcp数据</span><br><span class="line">tcp.dstport == 8181    # 只抓取目标IP端口为8181的tcp数据</span><br><span class="line">not arp                # 不是arp的其他数据</span><br><span class="line">tcp                    # 显示TCP协议的包</span><br><span class="line">tcp.srcport==443       # 显示TCP协议源端口为443的包</span><br><span class="line"></span><br><span class="line">ip.src == 192.168.1.100 and tcp.dstport == 80</span><br><span class="line">ip.addr == 192.168.1.100 and udp.port == 3000</span><br></pre></td></tr></table></figure>


    </div>

    
    
    

    <footer class="post-footer">




    <div>
        
            <div style="text-align:center;color: #ccc;font-size:14px;">
            ----------本文结束
            <i class="fas fa-fan fa-spin" style="color: #FF1493; font-size: 1rem"></i>
            感谢您的阅读----------
            </div>
        
    </div>





  
  <div class="my_post_copyright"> 
    <p><span>文章标题:</span><a href="/post/99bb7a64.html">LV06-01-网络工具-02-wireshark</a></p>
    <p><span>文章作者:</span><a href="/" title="欢迎访问 《苏木》 的学习笔记">苏木</a></p>
    <p><span>发布时间:</span>2024年10月27日 - 11:49</p>
    <p><span>最后更新:</span>2025年06月14日 - 00:25</p>
    <p><span>原始链接:</span><a href="/post/99bb7a64.html" title="LV06-01-网络工具-02-wireshark">https://sumumm.github.io/post/99bb7a64.html</a></p>
    <p><span>许可协议:</span><i class="fab fa-creative-commons"></i> <a rel="license" href= "https://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank" title="Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)">署名-非商业性使用-禁止演绎 4.0 国际</a> 转载请保留原文链接及作者。</p>  
  </div>
  


          <div class="post-tags">
              <a href="/tags/LV06-%E7%BD%91%E7%BB%9C%E7%BC%96%E7%A8%8B/" rel="tag"><i class="fa fa-tag"></i> LV06-网络编程</a>
          </div>

        

          <div class="post-nav">
            <div class="post-nav-item">
                <a href="/post/f7e7b2dd.html" rel="prev" title="LV06-02-网络基础-01-网络中的各种设备">
                  <i class="fa fa-angle-left"></i> LV06-02-网络基础-01-网络中的各种设备
                </a>
            </div>
            <div class="post-nav-item">
                <a href="/post/293a4529.html" rel="next" title="LV06-01-网络工具-01-Netwox">
                  LV06-01-网络工具-01-Netwox <i class="fa fa-angle-right"></i>
                </a>
            </div>
          </div>
    </footer>
  </article>
</div>






</div>
  </main>

  <footer class="footer">
    <div class="footer-inner">

  <div class="copyright">
    &copy; 2017 – 
    <span itemprop="copyrightYear">2025</span>
    <span class="with-love">
      <i class="fa fa-heart"></i>
    </span>
    <span class="author" itemprop="copyrightHolder">苏木</span>
  </div>
<div class="wordcount">
  <span class="post-meta-item">
    <span class="post-meta-item-icon">
      <i class="fa fa-chart-line"></i>
    </span>
      <span>站点总字数：</span>
    <span title="站点总字数">3.7m</span>
  </span>
  <span class="post-meta-item">
    <span class="post-meta-item-icon">
      <i class="fa fa-coffee"></i>
    </span>
      <span>站点阅读时长 &asymp;</span>
    <span title="站点阅读时长">225:26</span>
  </span>
</div>




    <span id="sitetime"></span>
    <script defer language=javascript>
        function siteTime()
        {
            window.setTimeout("siteTime()", 1000);
            var seconds = 1000;
            var minutes = seconds * 60;
            var hours = minutes * 60;
            var days = hours * 24;
            var years = days * 365;
            var today = new Date();
            var todayYear = today.getFullYear();
            var todayMonth = today.getMonth()+1;
            var todayDate = today.getDate();
            var todayHour = today.getHours();
            var todayMinute = today.getMinutes();
            var todaySecond = today.getSeconds();
            /*==================================================
            Date.UTC() -- 返回date对象距世界标准时间(UTC)1970年1月1日午夜之间的毫秒数(时间戳)
            year        - 作为date对象的年份，为4位年份值
            month       - 0-11之间的整数，做为date对象的月份
            day         - 1-31之间的整数，做为date对象的天数
            hours       - 0(午夜24点)-23之间的整数，做为date对象的小时数
            minutes     - 0-59之间的整数，做为date对象的分钟数
            seconds     - 0-59之间的整数，做为date对象的秒数
            microseconds - 0-999之间的整数，做为date对象的毫秒数
            ==================================================*/
            var t1 = Date.UTC(2017, 
                              5, 
                              19, 
                              0, 
                              0, 
                              0); //北京时间
            var t2 = Date.UTC(todayYear,todayMonth,todayDate,todayHour,todayMinute,todaySecond);
            var diff = t2-t1;
            var diffYears = Math.floor(diff/years);
            var diffDays = Math.floor((diff/days)-diffYears*365);
            var diffHours = Math.floor((diff-(diffYears*365+diffDays)*days)/hours);
            var diffMinutes = Math.floor((diff-(diffYears*365+diffDays)*days-diffHours*hours)/minutes);
            var diffSeconds = Math.floor((diff-(diffYears*365+diffDays)*days-diffHours*hours-diffMinutes*minutes)/seconds);
            document.getElementById("sitetime").innerHTML="已在这里 "+diffYears+" 年 "+diffDays+" 天 "+diffHours+" 小时 "+diffMinutes+" 分钟 "+diffSeconds+" 秒";
        }
        siteTime();
    </script>



    </div>
  </footer>

  
  <div class="back-to-top" role="button" aria-label="返回顶部">
    <i class="fa fa-arrow-up fa-lg"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>

<noscript>
  <div class="noscript-warning">Theme NexT works best with JavaScript enabled</div>
</noscript>


  
  <script src="https://cdnjs.cloudflare.com/ajax/libs/animejs/3.2.1/anime.min.js" integrity="sha256-XL2inqUJaslATFnHdJOi9GfQ60on8Wx1C2H8DYiN1xY=" crossorigin="anonymous"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/next-theme-pjax/0.6.0/pjax.min.js" integrity="sha256-vxLn1tSKWD4dqbMRyv940UYw4sXgMtYcK6reefzZrao=" crossorigin="anonymous"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/fancyapps-ui/5.0.28/fancybox/fancybox.umd.js" integrity="sha256-ytMJGN3toR+a84u7g7NuHm91VIR06Q41kMWDr2pq7Zo=" crossorigin="anonymous"></script>
  <script src="https://cdnjs.cloudflare.com/ajax/libs/lozad.js/1.16.0/lozad.min.js" integrity="sha256-mOFREFhqmHeQbXpK2lp4nA3qooVgACfh88fpJftLBbc=" crossorigin="anonymous"></script>
<script src="/js/comments.js"></script><script src="/js/utils.js"></script><script src="/js/motion.js"></script><script src="/js/next-boot.js"></script><script src="/js/pjax.js"></script>

  <script src="https://cdnjs.cloudflare.com/ajax/libs/hexo-generator-searchdb/1.4.1/search.js" integrity="sha256-1kfA5uHPf65M5cphT2dvymhkuyHPQp5A53EGZOnOLmc=" crossorigin="anonymous"></script>
<script src="/js/third-party/search/local-search.js"></script>




  <script src="/js/third-party/fancybox.js"></script>

  <script src="/js/third-party/pace.js"></script>


  




  

  <script class="next-config" data-name="enableMath" type="application/json">true</script><script class="next-config" data-name="mathjax" type="application/json">{"enable":true,"tags":"none","js":{"url":"https://cdnjs.cloudflare.com/ajax/libs/mathjax/3.2.2/es5/tex-mml-chtml.js","integrity":"sha256-MASABpB4tYktI2Oitl4t+78w/lyA+D7b/s9GEP0JOGI="}}</script>
<script src="/js/third-party/math/mathjax.js"></script>


 
        <div id="click-show-text"
            data-mobile = false
            data-text = 富强,民主,文明,和谐,自由,平等,公正,法制,爱国,敬业,诚信,友善
            data-fontsize = 15px
            data-random= false>
        </div>
       

      
        <script async src=https://cdn.jsdelivr.net/npm/hexo-next-mouse-effect@latest/click/showText.js></script>
      

      
    




    <script async src="/js/fancybox_param.js"></script>





<!-- APlayer本体 -->



</body>
</html>
